From eadadb0f82d3c6aad172b8143a72255e22ab3e45 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 05:47:12 +0000
Subject: [PATCH 01/10] ci: upload coverage to GitHub Code Quality

---
 .github/workflows/pytest_fast.yml   | 13 +++++++++++++
 .github/workflows/pytest_matrix.yml | 15 +++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/.github/workflows/pytest_fast.yml b/.github/workflows/pytest_fast.yml
index 8451b6737..1d495a12c 100644
--- a/.github/workflows/pytest_fast.yml
+++ b/.github/workflows/pytest_fast.yml
@@ -6,6 +6,11 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+  code-quality: write
+  pull-requests: read
+
 jobs:
   test-build:
     name: Build and Inspect Python Package
@@ -85,3 +90,11 @@ jobs:
         with:
           name: fasttest-coverage
           path: htmlcov/
+      - name: Upload coverage to GitHub Code Quality
+        if: always()
+        uses: actions/upload-code-coverage@v1
+        with:
+          file: htmlcov/coverage.xml
+          language: Python
+          label: code-coverage/pytest-fast
+          fail-on-error: false
diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index 9a4cc1188..0da32322b 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -16,8 +16,14 @@ on:
       - "unit_tests/**"
       - "poetry.lock"
       - "pyproject.toml"
+      - ".github/workflows/pytest_matrix.yml"
   pull_request:
 
+permissions:
+  contents: read
+  code-quality: write
+  pull-requests: read
+
 jobs:
   pytest:
     name: Pytest (All, Python ${{ matrix.python-version }}, ${{ matrix.os }})
@@ -58,6 +64,7 @@ jobs:
               - 'bin/**'
               - 'poetry.lock'
               - 'pyproject.toml'
+              - '.github/workflows/pytest_matrix.yml'
       - name: Set up Poetry
         uses: snok/install-poetry@v1
         if: steps.changes.outputs.src == 'true'
@@ -109,3 +116,11 @@ jobs:
         with:
           name: py${{ matrix.python-version }}-${{ matrix.os }}-test-coverage
           path: htmlcov/
+      - name: Upload coverage to GitHub Code Quality
+        if: steps.changes.outputs.src == 'true' && matrix.python-version == '3.11' && matrix.os == 'Ubuntu'
+        uses: actions/upload-code-coverage@v1
+        with:
+          file: htmlcov/coverage.xml
+          language: Python
+          label: code-coverage/pytest-matrix
+          fail-on-error: false

From 3a76a4e2e38ea2b8dab23c369fa66bbfad7baeaf Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 05:49:25 +0000
Subject: [PATCH 02/10] ci: remove unsupported Code Quality permission

---
 .github/workflows/pytest_fast.yml   | 1 -
 .github/workflows/pytest_matrix.yml | 1 -
 2 files changed, 2 deletions(-)

diff --git a/.github/workflows/pytest_fast.yml b/.github/workflows/pytest_fast.yml
index 1d495a12c..0682226f8 100644
--- a/.github/workflows/pytest_fast.yml
+++ b/.github/workflows/pytest_fast.yml
@@ -8,7 +8,6 @@ on:
 
 permissions:
   contents: read
-  code-quality: write
   pull-requests: read
 
 jobs:
diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index 0da32322b..ae820143c 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -21,7 +21,6 @@ on:
 
 permissions:
   contents: read
-  code-quality: write
   pull-requests: read
 
 jobs:

From ad3f02e4a7ecd80f991757235e44bf19348fa05a Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 05:52:52 +0000
Subject: [PATCH 03/10] ci: scope Code Quality permissions to coverage jobs

---
 .github/workflows/pytest_fast.yml   | 4 ++++
 .github/workflows/pytest_matrix.yml | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/pytest_fast.yml b/.github/workflows/pytest_fast.yml
index 0682226f8..b20dd44de 100644
--- a/.github/workflows/pytest_fast.yml
+++ b/.github/workflows/pytest_fast.yml
@@ -41,6 +41,10 @@ jobs:
   pytest-fast:
     name: Pytest (Fast)
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      code-quality: write
+      pull-requests: read
     steps:
       # Common steps:
       - name: Checkout code
diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index ae820143c..f1f741b7d 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -45,6 +45,10 @@ jobs:
       fail-fast: false
 
     runs-on: "${{ matrix.os }}-latest"
+    permissions:
+      contents: read
+      code-quality: write
+      pull-requests: read
     env:
       # Enforce UTF-8 encoding so Windows runners don't fail inside the connector code.
       # TODO: See if we can fully enforce this within PyAirbyte itself.

From 2e66a5ef9c31cbc62eb2f9a61e3b220d71432023 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 06:01:01 +0000
Subject: [PATCH 04/10] ci: limit Code Quality coverage XML to package files

---
 .github/workflows/pytest_fast.yml   | 2 +-
 .github/workflows/pytest_matrix.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pytest_fast.yml b/.github/workflows/pytest_fast.yml
index b20dd44de..f9e6a77d3 100644
--- a/.github/workflows/pytest_fast.yml
+++ b/.github/workflows/pytest_fast.yml
@@ -76,7 +76,7 @@ jobs:
         if: always()
         run: |
           poetry run coverage html -d htmlcov
-          poetry run coverage xml -o htmlcov/coverage.xml
+          poetry run coverage xml --include="airbyte_cdk/*" -o htmlcov/coverage.xml
 
       - name: Publish Test Results
         uses: EnricoMi/publish-unit-test-result-action@v2
diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index f1f741b7d..8d625f8fd 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -102,7 +102,7 @@ jobs:
         if: always() && steps.changes.outputs.src == 'true'
         run: |
           poetry run coverage html -d htmlcov
-          poetry run coverage xml -o htmlcov/coverage.xml
+          poetry run coverage xml --include="airbyte_cdk/*" -o htmlcov/coverage.xml
 
       - name: Publish Test Results
         uses: EnricoMi/publish-unit-test-result-action@v2

From 53564869af89b40666a7485054c8afb7e33f6424 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 06:40:23 +0000
Subject: [PATCH 05/10] ci: preserve test result check permissions

---
 .github/workflows/pytest_fast.yml   | 1 +
 .github/workflows/pytest_matrix.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/pytest_fast.yml b/.github/workflows/pytest_fast.yml
index f9e6a77d3..7eeb48d1e 100644
--- a/.github/workflows/pytest_fast.yml
+++ b/.github/workflows/pytest_fast.yml
@@ -42,6 +42,7 @@ jobs:
     name: Pytest (Fast)
     runs-on: ubuntu-24.04
     permissions:
+      checks: write
       contents: read
       code-quality: write
       pull-requests: read
diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index 8d625f8fd..b2c9c4b59 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -46,6 +46,7 @@ jobs:
 
     runs-on: "${{ matrix.os }}-latest"
     permissions:
+      checks: write
       contents: read
       code-quality: write
       pull-requests: read

From 166c75c5fc1808d470ea48d2db233a2cef0a2826 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 06:44:15 +0000
Subject: [PATCH 06/10] ci: upload matrix coverage after failures

---
 .github/workflows/pytest_matrix.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index b2c9c4b59..84ea2cbb1 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -121,7 +121,7 @@ jobs:
           name: py${{ matrix.python-version }}-${{ matrix.os }}-test-coverage
           path: htmlcov/
       - name: Upload coverage to GitHub Code Quality
-        if: steps.changes.outputs.src == 'true' && matrix.python-version == '3.11' && matrix.os == 'Ubuntu'
+        if: always() && steps.changes.outputs.src == 'true' && matrix.python-version == '3.11' && matrix.os == 'Ubuntu'
         uses: actions/upload-code-coverage@v1
         with:
           file: htmlcov/coverage.xml

From 84918c0dae9487837405302450f7c3d976234dc1 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 06:50:52 +0000
Subject: [PATCH 07/10] ci: pin code coverage upload action

---
 .github/workflows/pytest_fast.yml   | 2 +-
 .github/workflows/pytest_matrix.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pytest_fast.yml b/.github/workflows/pytest_fast.yml
index 7eeb48d1e..bf9c11389 100644
--- a/.github/workflows/pytest_fast.yml
+++ b/.github/workflows/pytest_fast.yml
@@ -96,7 +96,7 @@ jobs:
           path: htmlcov/
       - name: Upload coverage to GitHub Code Quality
         if: always()
-        uses: actions/upload-code-coverage@v1
+        uses: actions/upload-code-coverage@b51da2c3c1b23e04d2d6477cfc34350b1f5cd3e9 # v1
         with:
           file: htmlcov/coverage.xml
           language: Python
diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index 84ea2cbb1..e92ab807f 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -122,7 +122,7 @@ jobs:
           path: htmlcov/
       - name: Upload coverage to GitHub Code Quality
         if: always() && steps.changes.outputs.src == 'true' && matrix.python-version == '3.11' && matrix.os == 'Ubuntu'
-        uses: actions/upload-code-coverage@v1
+        uses: actions/upload-code-coverage@b51da2c3c1b23e04d2d6477cfc34350b1f5cd3e9 # v1
         with:
           file: htmlcov/coverage.xml
           language: Python

From e9b763197b9e53b8cbb4bd1e4c4eeaf4507b13fa Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 06:53:30 +0000
Subject: [PATCH 08/10] ci: checkout head sha for coverage mapping

---
 .github/workflows/pytest_fast.yml   | 2 ++
 .github/workflows/pytest_matrix.yml | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/pytest_fast.yml b/.github/workflows/pytest_fast.yml
index bf9c11389..cf703a0f8 100644
--- a/.github/workflows/pytest_fast.yml
+++ b/.github/workflows/pytest_fast.yml
@@ -50,6 +50,8 @@ jobs:
       # Common steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - name: Set up Poetry
         uses: snok/install-poetry@v1
         with:
diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index e92ab807f..6a7bb3a3b 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -58,6 +58,8 @@ jobs:
       # Common steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - id: changes
         uses: dorny/paths-filter@v3.0.2
         with:

From fc07ac35c1175dd5a6fc0c9d999e752ea2c4d844 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 16:13:38 +0000
Subject: [PATCH 09/10] ci: incorporate Code Quality coverage lessons

---
 .github/workflows/pytest_fast.yml   |  3 ++-
 .github/workflows/pytest_matrix.yml | 20 +++++++++++---------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/pytest_fast.yml b/.github/workflows/pytest_fast.yml
index cf703a0f8..757c83b47 100644
--- a/.github/workflows/pytest_fast.yml
+++ b/.github/workflows/pytest_fast.yml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -97,7 +98,7 @@ jobs:
           name: fasttest-coverage
           path: htmlcov/
       - name: Upload coverage to GitHub Code Quality
-        if: always()
+        if: always() && hashFiles('htmlcov/coverage.xml') != ''
         uses: actions/upload-code-coverage@b51da2c3c1b23e04d2d6477cfc34350b1f5cd3e9 # v1
         with:
           file: htmlcov/coverage.xml
diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index 6a7bb3a3b..e4782e354 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -18,6 +18,7 @@ on:
       - "pyproject.toml"
       - ".github/workflows/pytest_matrix.yml"
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -29,6 +30,7 @@ jobs:
     # Don't run on forks. Run on pushes to main, and on PRs that are not from forks.
     if: >
       github.event_name == 'pull_request' ||
+      github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'push' && github.ref == 'refs/heads/main')
     strategy:
       matrix:
@@ -73,23 +75,23 @@ jobs:
               - '.github/workflows/pytest_matrix.yml'
       - name: Set up Poetry
         uses: snok/install-poetry@v1
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         with:
           version: "2.0.1"
       - name: Set up Python
         uses: actions/setup-python@v5
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         with:
           python-version: ${{ matrix.python-version }}
           cache: "poetry"
       - name: Install dependencies
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         run: poetry install --all-extras
 
       # Job-specific step(s):
       - name: Run Pytest
         timeout-minutes: 60
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GCP_GSM_CREDENTIALS: ${{ secrets.GCP_GSM_CREDENTIALS }}
         run: >
@@ -98,18 +100,18 @@ jobs:
           -m "not linting and not super_slow and not flaky"
 
       - name: Print Coverage Report
-        if: always() && steps.changes.outputs.src == 'true'
+        if: always() && (steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch')
         run: poetry run coverage report
 
       - name: Create Coverage Artifacts
-        if: always() && steps.changes.outputs.src == 'true'
+        if: always() && (steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch')
         run: |
           poetry run coverage html -d htmlcov
           poetry run coverage xml --include="airbyte_cdk/*" -o htmlcov/coverage.xml
 
       - name: Publish Test Results
         uses: EnricoMi/publish-unit-test-result-action@v2
-        if: always() && !cancelled() && steps.changes.outputs.src == 'true' && matrix.python-version == '3.11'
+        if: always() && !cancelled() && (steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch') && matrix.python-version == '3.11'
         continue-on-error: true
         with:
           check_name: "PyTest Results (Full)"
@@ -117,13 +119,13 @@ jobs:
           files: |
             build/test-results/**/*.xml
       - name: Upload coverage to GitHub Artifacts
-        if: always() && steps.changes.outputs.src == 'true'
+        if: always() && (steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch')
         uses: actions/upload-artifact@v4
         with:
           name: py${{ matrix.python-version }}-${{ matrix.os }}-test-coverage
           path: htmlcov/
       - name: Upload coverage to GitHub Code Quality
-        if: always() && steps.changes.outputs.src == 'true' && matrix.python-version == '3.11' && matrix.os == 'Ubuntu'
+        if: always() && hashFiles('htmlcov/coverage.xml') != '' && matrix.python-version == '3.11' && matrix.os == 'Ubuntu'
         uses: actions/upload-code-coverage@b51da2c3c1b23e04d2d6477cfc34350b1f5cd3e9 # v1
         with:
           file: htmlcov/coverage.xml

From f2a8aea745e433ca83668887847d31d18c1e764e Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 16:18:43 +0000
Subject: [PATCH 10/10] ci: disable checkout credential persistence

---
 .github/workflows/pytest_fast.yml   | 1 +
 .github/workflows/pytest_matrix.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/pytest_fast.yml b/.github/workflows/pytest_fast.yml
index 757c83b47..dd01e0bdb 100644
--- a/.github/workflows/pytest_fast.yml
+++ b/.github/workflows/pytest_fast.yml
@@ -52,6 +52,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - name: Set up Poetry
         uses: snok/install-poetry@v1
diff --git a/.github/workflows/pytest_matrix.yml b/.github/workflows/pytest_matrix.yml
index e4782e354..6cec2fbe3 100644
--- a/.github/workflows/pytest_matrix.yml
+++ b/.github/workflows/pytest_matrix.yml
@@ -61,6 +61,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - id: changes
         uses: dorny/paths-filter@v3.0.2